All Apps and Add-ons

Can we integrate AWS S3 with our premise Splunk installation for non-hot data?

asherlohman
Engager

We are running Splunk on premise using bare metal servers with local disk. The amount of disk space locally is limited so we can only now store a limited amount of data in terms of time. We would like to expand the amount of data we are indexing over time so we can look at historical trends, etc. Has anyone ever used AWS S3 (or similar) to store data beyond the "hot" tier (i.e. medium, color, frozen)?

Tags (3)

kiyototamura
Explorer

One approach is to use open source log management tools like Fluentd so that you can unify and simplify your logging layer. Using the output plugins for Splunk and Amazon S3, you can send same data to both Splunk and S3. You can learn more about Fluentd and its enterprise offering below:

https://www.fluentd.org
https://fluentd.treasuredata.com
https://fluentd.treasuredata.com/splunk-optimize/

awurster
Contributor
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...